jschoubben 0778f8f0ae step-ca: stop offering acme-ca, so public names are certified by public-acme ...

step-ca and public-acme both offered acme-ca on novox, and route-proxy's pin names a node, not
a module — so which one certified the public names depended on provider order. After the
controller restart on 2026-10-03 it came out as step-ca, and every public site served a
certificate no browser trusts. step-ca's own names are already certified through
internal-acme-ca; acme-ca is the public authority's alone.

2026-10-03 10:54:43 +02:00

..

anthropic-consumer

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

anthropic-manager

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

audit-logger

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

baserow

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

build-agent

build-agent: the build machine as a node role every machine can hold (hq ADR 0190)

2026-10-02 22:28:48 +02:00

builder

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

ca-trust

ca-trust: a machine trusts the mesh's authority because a module put its root there

2026-09-29 15:07:40 +02:00

cloudflare-dns

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

confluence

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

de-spiegel

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

dhcpcd

And the uplink holders' capabilities return

2026-10-01 17:19:41 +02:00

distribution

distribution claims mesh-artifact-store, the seat's name for its scope (novox/hq ADR 0156)

2026-09-30 21:14:40 +02:00

dnsmasq

dnsmasq: listen addresses are a setting, and docker's file takes none

2026-10-02 11:49:57 +02:00

fail2ban

A ban list never holds a neighbour (hq ADR 0186)

2026-10-02 18:42:16 +02:00

gitea

gitea: the jail also bans what gitea's sshd refuses

2026-10-02 23:23:35 +02:00

gitlab

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

grafana

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

hello-web

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

home-assistant

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

icecast

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

influxdb

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

invoicing

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

jira

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

keycloak

Merge pull request 'The mesh's own files for a module are placed by the mesh, not the definition (issue 174)' (#197) from feat/the-mesh-places-its-own-files into main

2026-09-30 21:49:11 +00:00

lab

lab: the image carries what the builds and the lab call: python3, file, iproute2, sudo

2026-10-02 15:23:52 +02:00

letta

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

local-model-consumer

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

mailu

fail2ban holds the intrusion seat's verbs and composes the jails; mail, forge and proxy declare theirs (hq ADR 0179, to-be 31)

2026-10-02 17:02:49 +02:00

marrytts

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

matrix

No definition names this installation

2026-09-30 20:49:21 +02:00

mesh-catalog

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

mesh-vault

The vault's claim and its own event names return

2026-10-01 17:19:05 +02:00

minio

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

model-usage

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

mongodb

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

mosquitto

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

mssql

mssql: the query runs as a read-only login, one line, no variables; sqlcmd is installed (hq #193)

2026-10-02 00:25:22 +02:00

n8n

n8n: its media library is an access placed by the assignment

2026-10-01 02:02:30 +02:00

nats

An access has an id, and its mounts name it (issue 153)

2026-10-01 00:01:42 +02:00

networkmanager

And the uplink holders' capabilities return

2026-10-01 17:19:41 +02:00

nextcloud

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

nftables

nftables declares the ufw front end absent once its filter is loaded (hq ADR 0175)

2026-10-02 16:27:34 +02:00

nodered

nodered says it reads its API token and admin password at start, so the mesh may rotate them (hq 180)

2026-10-01 11:44:29 +02:00

ollama

Every module names its endpoints, and every route names the one it serves

2026-09-29 11:51:39 +02:00

only-office

No definition names this installation

2026-09-30 20:49:21 +02:00

openai-consumer

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

photos

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

photos-eef

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

photos-filip

A definition names no host path for its own data

2026-09-30 21:10:18 +02:00

postgres

postgres: the store's query runs as a read-only login, never as the admin (hq #193)

2026-10-02 00:09:09 +02:00

public-acme

public-acme: the roots field is named roots, not root

2026-09-25 18:08:28 +02:00

records

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

redis

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

resolv-conf

Rename seat claims to the mesh-*/node-* convention; retire verdaccio (ADR 0121)

2026-09-27 14:30:56 +02:00

resolved-split-dns

Rename seat claims to the mesh-*/node-* convention; retire verdaccio (ADR 0121)

2026-09-27 14:30:56 +02:00

route-adapter

An access has an id, and its mounts name it (issue 153)

2026-10-01 00:01:42 +02:00

route-proxy

The proxy's jail reads both refusals, each pattern naming the host once

2026-10-02 17:23:42 +02:00

searxng

searxng says it reads its secret key at start, so the mesh may rotate it (hq 180)

2026-10-01 12:09:47 +02:00

showcase

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

sshd

Every module names its endpoints, and every route names the one it serves

2026-09-29 11:51:39 +02:00

step-ca

step-ca: stop offering acme-ca, so public names are certified by public-acme

2026-10-03 10:54:43 +02:00

supabase

supabase: own secrets, and unique ids for its containers

2026-09-30 17:57:57 +02:00

systemd-networkd

And the uplink holders' capabilities return

2026-10-01 17:19:41 +02:00

umami

The mesh's own files for a module are placed by the mesh, not the definition (issue 174)

2026-09-30 22:29:28 +02:00

unifi

unifi: list networks and set the DNS their DHCP hands out

2026-10-02 11:53:16 +02:00

website

website: it listens on the port its container publishes

2026-09-30 21:01:47 +02:00